Security
Vultisig security practices, audits, and bug bounty program. Independent security assessments and responsible disclosure.
Vultisig prioritizes security through open-source transparency, professional audits, and responsible disclosure practices.
Security Model
Vultisig's security is built on threshold signature schemes (TSS), eliminating single points of failure:
No single private key: Keys are never constructed; vault shares create signatures collaboratively
Distributed trust: Compromising one device does not compromise funds
Open source: All code publicly auditable on GitHub
For technical details, see Security & Technology.
Audits
TSS Library (mobile-tss-lib)
The core TSS library has been audited by:
DKLS23 Implementation
The upgraded DKLS23 protocol (via Silence Laboratories):
Application Audits
Mobile and desktop application security assessments are conducted regularly. Reports are published upon completion.
Bug Bounty
Vultisig operates a responsible disclosure program for security researchers.
Scope
Vultisig mobile applications (iOS, Android)
Vultisig desktop applications (macOS, Windows, Linux)
Vultisig browser extension
TSS library (mobile-tss-lib)
Backend infrastructure
Rewards
Bounties are determined based on severity:
Critical
Direct fund theft, key extraction
Up to $50,000
High
Significant security bypass
Up to $10,000
Medium
Limited security impact
Up to $2,500
Low
Minor issues
Up to $500
Reporting
Report vulnerabilities to: [email protected]
Include:
Detailed description of the vulnerability
Steps to reproduce
Potential impact assessment
Your suggested fix (optional)
Do not publicly disclose vulnerabilities before they are addressed.
Security Best Practices
For Users
Backup vault shares to secure, offline storage
Verify addresses before signing transactions
Keep apps updated for latest security patches
Use Secure Vault for significant holdings
Never share vault shares or backup files
What Vultisig Cannot Do
Access your funds
Recover lost vault shares
Reverse blockchain transactions
View your private keys (they never exist)
Related
Security & Technology — Technical documentation
Emergency Recovery — Fund recovery if software unavailable
Privacy Policy — Data handling practices
Last updated
Was this helpful?